The maintainer reproduced a process crash triggered by structurally dense tool arguments that stayed below the established 4 MiB HTTP body limit. This exploits the difference between network bytes and work performed by JSON/schema validation: many small array elements or object keys can cause disproportionate allocation. Internet exposure and any front-door…
Inspect the ClaimsCase · DiggingBeagle record
Dense MCP tool arguments can exhaust memory below the HTTP byte cap
A valid-looking MCP request under 4 MiB could exhaust the Node.js heap by forcing validation of too many array entries or object properties. The patched element ceiling remains disabled until configured.
Scope
Network-reachable HTTP MCP tools accepting complex arrays or object records; stdio-only servers are excluded by the advisory.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The maintainers report a one-request JavaScript heap exhaustion caused by schema validation of many array elements/object properties within a body below the byte ceiling. Fixed packages provide maxToolInputElements but leave it disabled by default. No production attack frequency is established.
Assessed Oct 17, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MCP-TS-OPT-IN · CLM-MCP-TS-SMALL-DOS · MCP TypeScript SDK GHSA-46jr-4wx8-v453: tool input element exhaustion · MCP TypeScript SDK GHSA-f897-62hf-6gxq: HTTP size and batch limits
At a glance
No known malicious campaign or measured prevalence among MCP deployments. A safe element threshold varies with tool schema, runtime memory and request concurrency.
Limits and uncertaintyFull account
The maintainer reproduced a process crash triggered by structurally dense tool arguments that stayed below the established 4 MiB HTTP body limit. This exploits the difference between network bytes and work performed by JSON/schema validation: many small array elements or object keys can cause disproportionate allocation. Internet exposure and any front-door authentication determine who can submit such a request.
@modelcontextprotocol/sdk 1.3.0 through 1.31.0 and @modelcontextprotocol/server 2.0.0 through 2.2.0 are listed as affected. The October 15 fix adds maxToolInputElements in SDK 1.32.0 and server 2.3.0, but the option is off by default. The advisory illustrates 10,000 elements as a configuration example, not a universal safe cap. Tool owners must set a budget derived from actual valid workloads and retain an independent HTTP body-size limit.
This is distinct from the earlier advisory for unlimited POST body and batch length. An application can reject a 5 MiB request yet still exhaust memory validating a 3 MiB argument tree. The disclosure confirms the reproducer, not a production denial-of-service campaign.
Timeline
- Oct 15, 2026disclosure
Public disclosure
Claims & evidence
CLM-MCP-TS-OPT-INSDK 1.32.0 and server 2.3.0 add maxToolInputElements, but the limit is not enabled by a package upgrade alone.supported
Basis: reported finding
- supportsMCP TypeScript SDK GHSA-46jr-4wx8-v453: tool input element exhaustionprimary disclosure
Fix; configuration example
CLM-MCP-TS-SMALL-DOSThe official advisory documents JavaScript heap exhaustion from one HTTP request below the default 4 MiB request limit.supported
Basis: reported finding
- supportsMCP TypeScript SDK GHSA-46jr-4wx8-v453: tool input element exhaustionprimary disclosure
Summary; reproduction and impact
Controls and mitigations
- Upgrade to supported fixed versions; explicitly configure maxToolInputElements for the application.
- Set separate HTTP body and batch bounds and stress-test structure complexity and concurrency without using a production service.
- Upgrade @modelcontextprotocol/sdk to 1.32.0 or @modelcontextprotocol/server to 2.3.0 as applicable, and explicitly enable maxToolInputElements at a limit appropriate to each tool.
- Retain a separately enforced HTTP body-size limit; counting tool input elements does not bound all protocol parsing or envelope size.
Unknowns and contradictions
- No known malicious campaign or measured prevalence among MCP deployments.
- A safe element threshold varies with tool schema, runtime memory and request concurrency.
Sources and citation
Material revision history
- Oct 17, 2026 · Published version · first publication · revision 163